Incident Analysis

From March 16, 2015 to March 17, 2015

This training is a practical incident analysis workshop, focusing on windows systems and a bit traffic analysis with lots of hands on exercises. It is designed for anybody with IT background, willing to learn some of the essential steps during an incident analysis. This is not an advanced class, but more of an incident analysis 101 with a steep learning curve. Topics like incident handling and incident response will not be part of this course.

During this course you will (hopefully ;-) ) learn a lot about windows/malware internals, and how to

identify indicators of compromise,
analyse network traffic for suspicious behavior,
analyse forensic disk and memory images,
differentiate malware from harmless software,
analyse malware(behavior),
corelate gathered logfiles to a specific incident.

The language of this course depends on the attendees: on a pure german class it will be german, otherwise english.

Requirements for this course:

A laptop with administrative privileges and pre installed VirtualBox
TCP/IP Knowledge
Wireshark usage
Familiar with a shell

Good to have, but not necessary:

Experience with at least one programming language.
Basic knowledge about hacking techniques.

Frank Block

Frank Block is a security consultant working for ERNW GmbH with more than 7 years of experience. His main expertise lies with infrastructe/web application pentesting and the analysis of incidents. When not involved in customer projects, he researches in the memory forensics field.

Dominik Phillips

Dominik Phillips is a german pentester and security researcher with extensive experience in corporate environments. His daily work enfolds security evaluations and penetration testings of infrastructures. Besides of giving trainings in computer security, he is doing research and development in security areas.